The 2027 cyber insurance renewal season starts now for Jan 1 renewers. Brokers are collecting the evidence packet in October, submitting to markets in early November, and negotiating terms through mid-December for a January 1 bind. Any material you want in front of the carrier's actuary has to be captured, packaged, and sitting on the broker's desk by roughly October 25. That leaves about four weeks. What goes into the packet determines the premium; what does not go in gets priced as absent, not as favorable-and-unspoken.
This is not the 2023 hard market anymore. Carriers writing 2027 policies have three years of live claims data since the last major re-underwriting cycle, and the accounts that come in with clean claims history and specific, evidenced controls are seeing genuine competition again. The accounts that come in with a generic security narrative and a SOC 2 letter are seeing the flat renewal at last year's premium and a set of conditions that quietly widen the retentions and narrow the coverage grants. The gap between those two outcomes is the packet.
What actually moves premium in the 2027 book
Carriers writing the 2027 book are pricing three things specifically. The first is MFA depth. Not "we have MFA." The specific question is which accounts do not have MFA today, and among the ones that do, which factor combinations are in force. Perimeter access is the leading ransomware initial-access vector in the Coalition 2025 Cyber Claims Report, and the accounts most exposed to it are the ones running SMS-only fallback for privileged users, service accounts operating without MFA on the assumption that they are internal, and third-party remote-access tooling that bypasses SSO. Every one of those items is a specific bullet in the packet.
The second is backup restore testing. Every applicant says they have backups. Carriers price the applicants who have restored a backup to a clean environment inside the last 90 days differently from the applicants who have not. The 2024-2025 cycle is when carriers learned that "we back up daily" and "we can restore in 24 hours" are different statements, and the second one takes a documented drill to defend. The packet names the last drill date, the recovery time objective demonstrated, the recovery point actually achieved, and the specific critical systems included in scope.
The third is AI-usage attestation. This is the 2027 addition. Carriers are now asking whether the applicant uses generative AI in customer-facing workflows, what governance sits over agent authority, whether AI-generated content or code lands in production without human review, and what the incident-response posture is for deepfake-driven wire-fraud attempts. The applicants who can answer with specifics are getting favorable positioning. The applicants who answer "we have an AI policy" are getting priced against the market's worst-case assumption.
Security-awareness training completion percentages. Endpoint-detection tool inventory. SOC 2 letter existence. Threat-intel feed subscriptions. Vulnerability-scan cadence. These are hygiene items carriers assume you have and do not credit meaningfully in pricing. The evidence packet includes them because their absence is a red flag, but leaning on them as differentiation is the mistake that produces the flat renewal at last year's premium and quietly widened retentions.
The evidence packet, in the order carriers read it
Carriers open the packet in a specific order, and the account teams that build the packet in that order end up with better terms. Not because the carriers are gaming the read, but because the questions the underwriter asks in month one determine which follow-ups get asked in month two, and the follow-ups determine the final quote.
- The claims-history summary and the loss-run interpretation: Five years of prior claims, incident-response events that did not become claims, and any near-miss the applicant is willing to describe. Applicants that hide near-misses lose credibility when the carrier's own threat-intel feed shows the incident. Applicants that describe them cleanly with the resolution get credited for maturity.
- The MFA architecture map: Not the tool inventory. The architecture: which identities enforce MFA (workforce, customers, service accounts, admin accounts, vendors), which factors are permitted, which fallbacks exist, which accounts are exempted and why. A one-page diagram beats a five-page policy every time.
- The last backup-restore drill report: Named date, named scope, named RTO and RPO achieved, named critical systems in scope, named gap items and their remediation status. Signed by the person who ran the drill. Underwriters read this document more carefully than any other single artifact in the packet.
- The AI-usage inventory and governance narrative: Which workflows use AI, whether outputs land in production without human review, what agent authority is granted where, what the wire-fraud runbook looks like. This is the 2027-specific addition. Applicants who ship it get read as sophisticated. Applicants who omit it get priced against the market's worst-case assumption of what they must be doing.
- The vendor-concentration summary: Top ten vendors, their concentration overlap with each other, sub-processor exposure. Carriers pricing 2027 policies are increasingly asking about the applicant's Change Healthcare-shape exposure — how much of the applicant's operating risk sits behind a single vendor or a single vendor's sub-processor. A single-page summary tightens the negotiation.
- The 12-month posture-change narrative: What the applicant did in the last 12 months to reduce exposure, with dollar magnitudes attached where possible. This is the section that separates a flat renewal from a favorable one. Underwriters credit demonstrated posture change more than any static control claim.
The negotiation itself: what a defensible counter looks like
When the carrier's initial quote comes back, three lines are negotiable, and knowing which is which matters. Premium is negotiable, retention is negotiable, and specific coverage grants (biometric liability, wire-fraud sub-limit, ransomware exclusions with specific carveouts) are negotiable. Loading factors — the multiplier applied to base premium for named risk factors — are negotiable but require the broker to ask the carrier for the breakdown in writing. Applicants who do not ask for the loading-factor breakdown do not know which factors moved the quote against them, which means they cannot address the factors before the following year's renewal.
The defensible counter cites the packet. "Our restore-drill evidence shows recovery inside the RTO you assumed we would fail" is a defensible counter. "We disagree with the quote" is not. Every negotiation move traces back to a document in the packet or a specific commitment the applicant is willing to make and evidence in writing.
What "good" looks like on the packet-to-quote cycle
A well-run applicant is 45 days from Jan 1 bind and looks like this: broker submitted to five markets in the first week of November, three of the five have returned indicative quotes by the third week, one has returned a firm quote inside the target premium range with retentions the applicant can defend, and the loading-factor breakdown from the leading market names two specific factors the applicant can address inside the coverage year for the following renewal. The applicant is not in a rush, is not chasing a single market, and is not accepting a quote that comes with quietly widened retentions on the ransomware coverage grant. The packet did that work. The negotiation is a follow-through, not a fresh case for maturity.
A poorly-run applicant is 15 days from Jan 1 bind, has one market with a flat renewal at last year's premium, has retentions that have quietly moved from $250K to $500K on the two coverage grants most likely to be triggered, and is being told by the broker that the market is what it is. The packet did not do the work because the packet was a SOC 2 letter, a security-awareness training screenshot, and a two-paragraph narrative about the applicant's culture. The market response reflects that. The move at this point is not to negotiate — it is to accept the flat renewal, and build the packet during the coverage year so the following renewal has a real case.
Where vCISO Lite sits in this
The evidence packet is the artifact carriers price. We built quantify cyber risk in dollars as the CRQ methodology that produces the numbers underwriters credit — FAIR-style loss scenarios with named methodology, cited inputs with vintage, and the exposure math that lets a broker anchor a defensible counter to a specific dollar figure. Vendor Risk Management produces the vendor-concentration summary carriers now ask for on Jan 1 renewals — top-20 vendors scored across five dimensions including AI-usage attestation and model-provider concentration. And the platform's evidence graph produces the 12-month posture-change narrative underwriters credit most heavily, because every remediation action, control uplift, and mitigation is captured as a signed record with the dollar magnitude attached.
The Other20 vCISO layer owns the broker conversation itself — packet assembly, market-selection strategy, quote-interpretation, and the loading-factor breakdown negotiation that most applicants do not know to ask for. Priced from the same platform tiers. The vertical playbook lives at quantify cyber risk in dollars.
The letter you write in October, if you write one at all
Some applicants send a cover letter with the packet. Most do not. The ones that do write a one-page note that names three specific 12-month posture changes, the dollar magnitude of each, and the exposure reduction the change produced. The letter is signed by the CISO or the security-owning executive, not the broker. Underwriters read it. Applicants who send a generic "we take security seriously" letter are worse off than applicants who send nothing at all, because the generic letter signals that the packet's substance is thinner than it looks.
The bottom line
The Jan 1 renewal is priced on three specific control areas (MFA depth, restore testing, AI-usage attestation) and one specific narrative (the 12-month posture change). Everything else in the packet is table stakes, and the market response reflects it. Applicants that build the packet against those four items get real competition. Applicants that lean on SOC 2 and security-awareness training get last year's premium and quietly worse terms. The window to affect the 2027 renewal is October and early November, and it closes fast.